Windows Analysis Report
plumsail-form-2024216-105537.pdf

Overview

General Information

Sample name:	plumsail-form-2024216-105537.pdf
Analysis ID:	1417184
MD5:	5dcc8013846aee3e0487cf46f2115db5
SHA1:	a4658e047c70295253df988eff249b1d24e633b3
SHA256:	8b8afec2d2937699e8cc80f359204e1a23619fe0d81a3e57985033d22a2139a9
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Classification

Signatures

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49760 version: TLS 1.2

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 23.48.8.182 23.48.8.182
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7KB8u3pc83uspSA&MD=gmVuXcTn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7KB8u3pc83uspSA&MD=gmVuXcTn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: plumsail-form-2024216-105537.pdf	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: plumsail-form-2024216-105537.pdf	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlhttp://www.apache.org/licenses/LICENSE-2.0.html
Source: plumsail-form-2024216-105537.pdf	String found in binary or memory: http://www.telerik.com
Source: plumsail-form-2024216-105537.pdf	String found in binary or memory: http://www.telerik.comhttp://www.telerik.comhttp://www.telerik.comhttp://www.telerik.comApache
Source: plumsail-form-2024216-105537.pdf	String found in binary or memory: https://plumsailforms.blob.core.windows.net/9a82efd0-7ed8-4446-8eeb-7f9b67b5f5d3/4bf2c103-b239-4062-

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49760 version: TLS 1.2

Document contains embedded VBA macros

Source: chromecache_222.10.dr	OLE indicator, VBA macros: true
Source: chromecache_223.10.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: chromecache_222.10.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chromecache_223.10.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean2.winPDF@38/51@2/4

Source: plumsail-form-2024216-105537.pdf

Initial sample: https://plumsailforms.blob.core.windows.net/9a82efd0-7ed8-4446-8eeb-7f9b67b5f5d3/4bf2c103-b239-4062-bed8-c7f971eee861/bf1155fb-d125-45ec-9a84-5e69a12a60b7/ab6eaf35-7053238.jpg

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-28 18-34-09-907.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\plumsail-form-2024216-105537.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1568,i,9319185107332236108,1686675044157375733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://plumsailforms.blob.core.windows.net/9a82efd0-7ed8-4446-8eeb-7f9b67b5f5d3/4bf2c103-b239-4062-bed8-c7f971eee861/bf1155fb-d125-45ec-9a84-5e69a12a60b7/ab6eaf35-7053238.jpg"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1988,i,11069634344130637693,6430874663071058120,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1568,i,9319185107332236108,1686675044157375733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1988,i,11069634344130637693,6430874663071058120,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: plumsail-form-2024216-105537.pdf	Initial sample: PDF keyword /JS count = 0
Source: plumsail-form-2024216-105537.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: plumsail-form-2024216-105537.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.31.99	www.google.com	United States	15169	GOOGLEUS	false
23.48.8.182	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4

Contacted Domains

Name	IP	Active
www.google.com	142.250.31.99	true

ID:	1417184
Product:	CloudBasic
Start time:	18:33:21
Start date:	28.03.2024
Sample:	plumsail-form-2024216-105537.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	5dcc8013846aee3e0487cf46f2115db5
SHA1:	a4658e047c70295253df988eff249b1d24e633b3
SHA256:	8b8afec2d2937699e8cc80f359204e1a23619fe0d81a3e57985033d22a2139a9
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	1B2578A7AF5F0524F632E214446D02C4	452401F5745786CBCA11F8A8C10EBB2C2ADBBDA7	E18D5765BFB01ABFDDB8AABA191D41FCD69D9E5B7F078B688E7C4960B2BB6AC4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	1B2578A7AF5F0524F632E214446D02C4	452401F5745786CBCA11F8A8C10EBB2C2ADBBDA7	E18D5765BFB01ABFDDB8AABA191D41FCD69D9E5B7F078B688E7C4960B2BB6AC4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	2D1CBE32BFB2C6A94D69ADB83EC5F54F	0B7A82C55D5FECA2E3DD5381AC986C085111DD0E	54798DD62821EB04DB3BDAD81281B1C17842B318DC3AE27625D3A1145D6015D2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	2D1CBE32BFB2C6A94D69ADB83EC5F54F	0B7A82C55D5FECA2E3DD5381AC986C085111DD0E	54798DD62821EB04DB3BDAD81281B1C17842B318DC3AE27625D3A1145D6015D2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	C0FBBAEDE3DB0B1C8CE7AE19B5D0A844	CE1C80D7C22C39446FA412E591D0099B8DAB4CE2	5DA33143A52F030BF5D1F094291CB7D17A47A8E0AF9FC284F5B75DDD4D600C1E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f807316a-24e9-472d-9427-4e9d251125e9.tmp	JSON data	C0FBBAEDE3DB0B1C8CE7AE19B5D0A844	CE1C80D7C22C39446FA412E591D0099B8DAB4CE2	5DA33143A52F030BF5D1F094291CB7D17A47A8E0AF9FC284F5B75DDD4D600C1E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	85AFB58CF568F3E7C38016DA4F701DB3	0CCC5D90D696DD0A1C1611E873AA540FCC97C5C6	EA2BD75BB932808F2DCBBD27099786A9B87609633B0A651A882F26FE246CC7F4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	93A2859A99E0C1DA219F154F05D4AD8B	84D368ECB34AF57D209B2D244C4C570FBF33DE2E	719464A71C1BDFC8E497C1A3BE0E92662828939530361DC01189BF590678F15C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	93A2859A99E0C1DA219F154F05D4AD8B	84D368ECB34AF57D209B2D244C4C570FBF33DE2E	719464A71C1BDFC8E497C1A3BE0E92662828939530361DC01189BF590678F15C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240328173411Z-160.bmp	PC bitmap, Windows 3.x format, 164 x -120 x 32, cbSize 78774, bits offset 54	8040E7F1C91D18520E4B8F9FFC0F80F0	5972B0F725506D16E79BEC9B6BBFDA8E1D872E53	E672460F19B7F6FFFC4BA25743652EE241AE42F575A7628246F4EC6F1283175A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	E87B7A54F07CDA2ACE28B40094278C0E	2BFE63B4559FE7B79E6F55C4825A199FE98C30AF	6F60C538AD4C544B66DB6E561FC401A71E628996F60338E3F4ADE01909D81C03
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	33E750CBA4C3CA19E20644C476663670	DB7860976F0D50D27E8DE0D2478B1404187A45BB	60AD4240E3334C5236CF0015CE4881F91294D4CF7A315E1474F58084F197B8A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7504	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7504	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	758B42992DDFC41CB5E57069C621B54A	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	9DEC2CAD4B4F7302F25060391848986A	74CD5A71185C93E1761C7C1E999D61465896E389	0869815CD5EEFECE31EB83C2BE2539D0136905D95A6B6822A758F593A913C001
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	A847F6D176ACF9557D07099D7AD6FD1E	CF4CD96A7B4391A48415ED14FE65174361443593	07BB80EC0FAFC172B6692707978091C23821B5FC664C4B23AB32B497EF41B223
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	F5D86DA588102E47743716AF3AA442F3	3214F54CAE4B5BC44A0F41BB9868D4D335628A66	D25A30615181E845618F9F0C84D37F70AD09202456B28987790ECFC5961FEE56
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	1CC162D7DEB4898DD9ADD6295DFDEB9D	E1DAFCE3FEEBA985BFF30AC3B1150CAE3204E62C	4D9A7C3F8122C3A6F20D4FC5507366B777B7B27FD9341CF6734D9D40CC9203CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	82DCD178B633B46E3BF7C3317D2D60ED	E36D65225D36BD93DA46F9A8FD5805CB98385F85	F3120B85E6880E44192DB80792D2FC77236708BDB13609DD600E22360F04A217
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D19E40ED01A9CE4D16131261300E8847	025C63C8F744CD09FD0FA42629E6D08E84503E7A	A0E1407DA4212FB91EDF12D4785FECBD2054FCA4E8A5E0E1301A874A13DD7B8D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	552BB8B37327EBDC9BCE8ED9DAF7369E	DA7E1848049C1E15225BF840C3927020E9331312	F848D7517C4EE2112EE41D08435BE08B00FF9C809FC8A26D6772DB7886E63BF0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	B7A6D3924CDE339FDA2E0644FE102561	A252AD87AA8DB790AF25EF2B9930DB3FE389BE68	67619CC601EF4FA02FED1249DA17529557FDC3B8E3C72AC2402E9BA56DE11D7C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	78DB70132DCD89344968C8981810B78B	6DFEF3458E95B690EF0BC880142DC2A537AA4D45	A84CB029FBCEDBD98D9465296A03EB8AB4024DC7DA06952113205A725F8A3A4E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	144B8D58646FF00B4483A324B4C9B7EA	7EC2E428D22469CFE5F0739500B9E56CB570D4A1	B6AAB863C32B14761B559F67A140F02FBA7798D61989ADC7B7693C8698A89014
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	D0C751A36D77BFA3CB1F60327D0401DE	4780BE1E55EDDAB386D0136B504BA6870D7A2DBC	F4355CCE5AFB2A53E641DDED197B7A4E1A4D720B2399EF83B417B46E1F7C0707
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	190700F18FA4575C4E8A27FAC65BBAB5	A57C4342D3307398343EF7A0E16929ADC8DCFD66	6A7BC26C37C74EE924BDD0A9CC9429E00BA712919E50C5849853A71B91F07A86
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	59A50746BCBE992753A7BBB1CB2D4943	04704A1EBDA37477B87759CC7FA0153B4D09E2D3	E1BFC3AA1CB6E99D641036E39DB322FABBD77EC3D383B627F21E440F3571B6D1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	DF1F0A051B0FF68A9207CF57658ADE47	C234B67DF6A566B97B561AAA06ACC116F9FE191A	65E557069152788F60D8E38626B3F8540139E022943B0A75843284AB8D1C5244
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	D38C1BC8B72DE1A3235C1849034214C1	CA5D43AEC3A03418BC754CDF75D3076053D785BD	11BF37E3A17CFBD467857BC785252F84DD20FEF3E79FFD2FBD295956C89EC6C1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	B2F3C7A7DB7D9B006B305823B86AAB5F	9D9AB65C41A3D95BBB894B661986CBC1783E8C16	2FC6E6548207EB4A8639ED00636C6E5A9089460FEB4233105CCB1490F179E018
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	91D74E63791E80B4072E679AAE864D16	084E0C5465C024A09966BC22987333DE558670F1	6A12B216DCB8806070672EE0B602416E583C2C59177342712FB21A2917115CAD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	E987584D670665558741D9F5E54E1339	205D27B8C61F145E9B657BE047038F4A18D5104F	D07AA2FC82E5E6816D80761C3F1AA8D07ADDFFF4BB09DEEE942ED85D3E30ECB8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	FBCE7476C2E8777CCD3D21A4A88D09E9	0A101083CEC9F69CFE88A252BCEB0A61414036DE	68881A59291E7EAC839B2B4E7AC5CEBFE01A8FD8F7D77027D54B6F5A8C88E461
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	F5E00D6EC30843EEB5ECB117DA0172BE	A2F9D5A4B23480F12CF8A90A2FDEB21E70F7A72B	B7E3A1856B76B9EC4DD8696E7AE2E8615A32D5B78CAF79E2FD7D1F8597E396BC
C:\Users\user\AppData\Local\Temp\MSIfd7a0.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F322F3DC8C33B112896792E7B7EC1DC5	22CEAEBC767CA3D82A6F79C65B5BF70ACB92FEC5	DB9E647513F8D725267C35E00181A6AF9F4618CC2027C629E55D2F98FDA52779
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-28 18-34-09-907.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	657626F64BB68200B239799E16A83A2C	32FE78D40A4A67B176D0059E6BF20CC36A3F932B	1AEDBB0CA0DC06963F158EC1222E483B2A090F045C88A72B3B6CD500D74AE955
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	1AE2DC65D4C019000A53EC20ED7354EB	1949188E3F9D3D99E81E1EAEA011DFE7EB0A3F69	ABD130B6AE6FEAEF3B4FECF3143A51E1D46D4EEB8F7C340AADA4B086E4BAD515
C:\Users\user\AppData\Local\Temp\acrocef_low\722b8d8d-8a6d-495c-93de-d8251577ee21.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7bc0f47e-c93c-44f3-8e2b-e34bdb2f525c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\b5e2a5f1-a437-4ddf-94d7-507705f552a7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f3231f0a-e875-449b-be7f-3a812f395143.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
Chrome Cache Entry: 222	XML 1.0 document, Unicode text, UTF-8 (with BOM) text	6E01BACA7ECA43CD9F6FB21AAB6819D4	6E3AFE20451247C1D1D9B6AF036941CD8E2EA622	80D9D0909B82F774521C36D35D71ED54D45B79FC9545391E031609F76BBB97AC
Chrome Cache Entry: 223	XML 1.0 document, Unicode text, UTF-8 (with BOM) text	0DFD1EF54F01D07467D05C4E3E56FC08	A548C16336A0AD3481AE721F386BB84005255DEE	7EFA5306FE51FE2A29414174D46950F223AA6E5B42817A654694D85CA5F473E5

Windows Analysis Report
plumsail-form-2024216-105537.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report plumsail-form-2024216-105537.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report
plumsail-form-2024216-105537.pdf